Sources Sought Notice 832572693.pdf

Page 1 of 4 Pages

SOURCES SOUGHT NOTICE

832572693

The Defense Information Systems Agency (DISA) is seeking sources for the United States (U.S.)

Navy Military Sealift Command (MSC) Cybersecurity Support Services (CSS) to provide cybersecurity operations, risk management and compliance services.

CONTRACTING OFFICE ADDRESS:

DISA/Defense Information Technology Contracting Organization (DITCO) Non-DISA Services (PS8312) 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses and large businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

The MSC CSS is seeking information from potential sources for cybersecurity operations, risk management, and compliance support. The requirement is to provide all elements of cybersecurity support including:

• Supporting vulnerability management through cybersecurity site visits to assist civilian and contract mariners with patching and scanning of systems and networks

• Afloat site, system, and operational technology Assessment and Authorization support including mission-based cybersecurity risk assessments.

• Supporting inspections and performing compliance visits to measure cybersecurity readiness of individual ship or department adherence with compliance measures.

MSC requires sources with an in-depth knowledge of Department of the Navy and Department of Defense (DoD) cybersecurity directives and procedures.

The anticipated period of performance is one (1) 12-month Base Period plus four (4) 12-month Option Periods, estimated to be the following:

Base Period: May 15, 2026 – May 14, 2027 Option Period 1: May 15, 2027 – May 14, 2028 Option Period 2: May 15, 2028 – May 14, 2029 Option Period 3: May 15, 2029 – May 14, 2030 Option Period 4: May 15, 2030 – May 14, 2031

The anticipated place of performance will primarily be the contractor facility. Frequent meetings at Government sites in the Norfolk, VA metropolitan area is expected, and would be considered

Page 2 of 4 Pages routine and not billable travel. Tasks may require travel to other MSC, U.S Navy, United States Transportation Command (USTRANSCOM) or DoD installations to include but not limited to the following, which may be considered billable:

• MSC Network Operations Center, Pensacola FL

• MSC Headquarters, Norfolk VA

• MSC Ship Support Unit (SSU) San Diego CA

• MSC SSU Japan

• MSC SSU Singapore

• MSC SSU Bahrain

• MSC SSU Guam

• Military Sealift Command Office (MSCO) Pearl Harbor, HI

• MSCO Diego Garcia

• MSC SSU Naples

• Pacific Region Network Operations Center, Wahiawa, HI

• Unified Atlantic Region Network Operations Center, Norfolk, VA

• USTRANSCOM Headquarters, Scott AFB IL

• Other Contractor Facilities

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION

AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS

NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY

VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract/Task Order Number: GS35F0414U/HC1028-21-F-0400 Contract Vehicle: General Services Administration (GSA) Multiple Award Schedule (MAS) Incumbent and their size: Tetrad Digital Integrity, LLC/Small Business Method of previous acquisition: Small Business Set-Aside Period of performance: May 15, 2021 through May 14, 2026

REQUIRED CAPABILITIES:

Page 3 of 4 Pages

1. MSC Cyber team is responsible for vulnerability management of MSC systems and networks. This includes testing and distribution of patches, providing shipboard assistance to resolve any patching issues, and conducting data analysis to monitor patching compliance of ships. Describe your experience with vulnerability management of enterprise systems.

Include any tools and techniques used to develop and test patches, monitor compliance, and troubleshoot issues.

2. MSC Cyber team supports the development, validation, and processing of approximately 200 different Risk Management Framework (RMF) authorization packages. Describe your experience developing, validating, and processing RMF packages for systems, sites, networks, and applications, to include any experience with Platform/Operational Informational Technology systems.

3. The U.S. Navy is moving more towards assessing cyber mission risk of systems and platforms instead of focusing solely on compliance-based assessments. Describe your experience and methodology for conducting mission based cyber risk assessments.

4. Cyber readiness on MSC ships is of paramount importance. One method of assessing readiness is to conduct cyber readiness assist visits to analyze the overall cyber compliance of the ship and provide recommended courses of action to mitigate/resolve deficiencies.

Describe your experience with cybersecurity compliance inspections including techniques used to conduct the inspection and mitigate deficiencies. Shipboard experience should be specifically noted.

5. Given the large amount of cyber data available to MSC, a comprehensive knowledge management dashboard is sought to track and report on the overall cyber readiness posture of MSC ships and shore facilities. Describe your experience developing dashboards to track and report on enterprise level data. Include development methodologies and tools/programming languages used.

SPECIAL REQUIREMENTS:

• All contractor personnel performing work under this contract shall be fluent in English.

• All contractor personnel performing work under this contract shall be citizens of the United

States of America.

• All contractor personnel performing work under this contract shall pursue and obtain

SECRET clearances for all personnel as required by applicable Task Orders with the contract.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519, Other Computer Related Services, with the corresponding size standard of $34 Million.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses

Page 4 of 4 Pages must demonstrate the company’s ability to perform in accordance with FAR clause 52.219- 14, Limitations on Subcontracting.

To assist in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP3, NASA SEWP V, GSA: OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Central Daylight Time (CDT) on September 4, 2025 to talitha.k.schmelzer.civ@mail.mil with a copy to rebecca.d.mooney.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page:

www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.